AI and autonomous systems
What is AI doing on our behalf, and who approved it?
AI is one leadership concern among the others on the decide hub: governed like the rest, which is precisely the point. The questions are the familiar governance questions asked of a new class of system: what is deployed, on whose approval, under whose oversight, with what authority, and what happens when it acts beyond it.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
- Choosing between human review, human oversight, and autonomous authority for AI-assisted workdecision narrative
- What the governing body should require before an AI system goes into productionexecutive brief
- What the governing body should require for AI incident-response readiness before productionexecutive brief
- From AI idea to retirement: the governed life of an AI systemjourney
- What the governing body should ask about the organization's AI inventory, risks, incidents, suppliers, and changeoversight question set
- When an AI agent acts beyond its granted authorityscenario
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- AI Governance Council Chartercharter, AI
- Exception and Risk Acceptance Management Policypolicy, Governance
- Identity and Access Management Policypolicy, Security
- AI Governance and Risk Frameworkframework, AI
- AI Model Risk Frameworkframework, AI
- Supplier and Cloud Governance Frameworkframework, Supply chain
- AI Access and Agent Permissions Standardstandard, AI
- AI and Agentic Development Security Standardstandard, AI
- AI Model Risk Standardstandard, AI
- AI Security and Risk Standardstandard, AI
- AI Testing, Validation and Documentation Standardstandard, AI
- Data Classification and Handling Standardstandard, Security
- Logging and Monitoring Standardstandard, Security
- Records Retention and Destruction Standardstandard, Governance
- AI Audit Procedureprocedure, AI
- AI Evaluation Procedureprocedure, AI
- AI Model Lifecycle Management Procedureprocedure, AI
- AI System Impact Assessment Procedureprocedure, AI
- Change Management and Configuration Control Procedureprocedure, Operations
- Cross-Domain Incident Coordination Procedureprocedure, Resilience
- Risk Acceptance Procedureprocedure, Risk
- Security Incident Response Procedureprocedure, Security
- Third-Party AI Due Diligence Procedureprocedure, Supply chain
- Training Data Governance Procedureprocedure, AI
- AI Board Oversight Guideguide, AI
- Minimum Viable Governance Structure Guidelineguideline, Governance
- AI Incident Response Planplan, AI
- AI Risk Registerregister, AI
- Concentration Risk Registerregister, Supply chain
- Model Context Protocol Server Registerregister, AI
- Model Registryregister, AI
- Role Authority Registerregister, Governance
- AI System Register Templatetemplate, AI
- Board Risk Report Templatetemplate, Risk
- Risk Appetite Statement Templatetemplate, Risk
- Supplier Offboarding Evidence Templatetemplate, Supply chain
- Tabletop Exercise Templatetemplate, Resilience
- AI-Specific Risk Methodology Annexannex, Risk
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- Basel Committee Corporate Governance Principles
- Canada TBS Guide on the Use of Agentic AI (comparator)
- Canada Treasury Board Directive on Automated Decision-Making
- CER Directive (EU) 2022/2557 of 14 December 2022 Article 15 (critical entities)
- China Cybersecurity Law Article 27
- China Cybersecurity Law Articles 27 and 44 para. 2
- China Data Security Law Article 29 (data security incidents; unofficial DigiChina English translation of the law in force 1 September 2021)
- Cloud Security Alliance (CSA)
- COBIT
- Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 Article 5 (time limits for DORA major-incident reports)
- COSO ERM 2017
- CSA AI Model Risk Management Framework (2024)
- CSA AICM
- CSA CCM
- Datasheets for datasets
- DORA
- DORA RTS (EU) 2025/301
- EBA Guidelines on outsourcing arrangements
- ETSI EN 304 223 V2.1.1
- ETSI TR 104 128 V1.1.1 (2025-05)
- EU AI Act
- EU GPAI Code of Practice (Copyright Chapter, July 2025)
- EU GPAI Code of Practice, Safety and Security Chapter (July 2025)
- FRC UK Corporate Governance Code
- FSB Cyber Lexicon and Third-Party Risk Toolkit
- GDPR
- IEEE 2883-2022
- IIA Three Lines Model 2020
- ISO 15489-1:2016
- ISO 19011:2026
- ISO 22301:2019
- ISO 28000:2022
- ISO 31000
- ISO 37000:2021
- ISO/IEC 20000-1:2018
- ISO/IEC 23894:2023
- ISO/IEC 25059:2023
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27018:2025 A.10.1 (notification of a data breach involving PII)
- ISO/IEC 27031:2025
- ISO/IEC 27035-1:2023
- ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023
- ISO/IEC 27035-2:2023
- ISO/IEC 27035-3:2020
- ISO/IEC 27035-4:2024 (Part 4: Coordination)
- ISO/IEC 27036
- ISO/IEC 27036-2:2022
- ISO/IEC 27040:2024 ยง10.6.7
- ISO/IEC 27701
- ISO/IEC 38507:2022
- ISO/IEC 42001
- ISO/IEC 42005:2025
- ISO/IEC 42006:2025
- ISO/IEC 5259-2:2024
- ISO/IEC 5259-3:2024
- ISO/IEC 5259-4:2024
- ISO/IEC 5259-5:2025
- ISO/IEC 5338:2023
- ISO/IEC 8183:2023
- ISO/IEC TR 24027:2021
- ISO/IEC TR 24029-1:2021
- ISO/IEC TR 27563:2023
- ISO/IEC TS 25058:2024
- LGPD
- MCP specification
- MITRE ATLAS
- Model card pattern
- NIS 2
- NIS 2 Implementing Regulation (EU) 2024/2690
- NIST
- NIST AI 100-2e2025
- NIST AI 600-1 (Generative AI Profile)
- NIST AI RMF
- NIST CSF
- NIST IR 8286C Rev. 1
- NIST IR 8312
- NIST IR 8596 (Cyber AI Profile), Initial Preliminary Draft (DRAFT-WATCH)
- NIST SP 1270
- NIST SP 800-161 Rev. 1
- NIST SP 800-184
- NIST SP 800-37 Rev. 2
- NIST SP 800-53
- NIST SP 800-61 Rev. 3
- NIST SP 800-84
- NIST SP 800-88 Rev. 2
- OECD AI Principles
- OECD G20 Principles of Corporate Governance
- OECD Recommendation on Critical Information Infrastructure Protection
- OSFI Guideline E-21
- OSFI Guideline E-23 (2025, effective 2027)
- OWASP AI Exchange
- OWASP LLM Top 10
- OWASP Top 10 for Agentic Applications (2026)
- OWASP Top 10 for Agentic Applications (ASI)
- PCI DSS v4.0.1
- PIPL
- PRA SS1/21
- SANS CAISG v1.4
- SANS Critical AI Security Guidelines v1.4 (March 2026), Incident Response and Forensics for AI Systems
- Singapore IMDA Model AI Governance Framework for Agentic AI (v1.5, 2026)
- TIBER-EU
Go deeper